External Blocklist (EBL) Threat Feed Parse Error Triggering Loop in 'urlfilter'
Third-party External Blocklist (EBL) domain and URL feeds containing malformed regex wildcards cause catastrophic backtracking in the /bin/urlfilter worker daemon, pegging core CPU utilization at 100% and stalling enterprise web browsing.
Technical Root Cause Analysis
FortiOS supports automated ingestion of dynamic External Blocklists (EBL) formatted as plain text URL or domain feeds. The urlfilter engine parses feed entries into an internal Non-deterministic Finite Automaton (NFA) regex graph for rapid match evaluation.
When upstream threat feed maintainers publish malformed wildcards (such as unconstrained nested repetitions like .*.* or unanchored sub-expressions), the regex parser in FortiOS 7.2.4–7.2.7 fails to enforce recursion limits during URL evaluation.
As incoming HTTP/HTTPS client requests match against the corrupted pattern graph, the PCRE evaluation engine enters catastrophic backtracking. The urlfilter worker pegs its assigned CPU core at 99.8–100%, blocks the WAD proxy evaluation pipeline, and results in HTTP 504 Gateway Timeouts across all inspection profiles.
Affected Firmware & Blast Radius Matrix
| FortiOS Branch | Vulnerable Builds | Confirmed Clean Build | Status & Workaround |
|---|---|---|---|
| FortiOS 7.2 | 7.2.4 – 7.2.7 | 7.2.8+ | Disable malformed EBL resource & kill -15 worker |
| FortiOS 7.4 | 7.4.0 – 7.4.2 | 7.4.3+ | Sanitize threat feed syntax or upgrade build |
| FortiOS 7.0 | 7.0.0 – 7.0.15 | 7.0.x Branch Clean | Legacy EBL compiler does not exhibit backtracking loop |
Platform Impact: Affects all FortiGate models (desktop FG-40F/60F up to high-end FG-3000F) that subscribe to dynamic External Blocklists (EBL) integrated into Web Filter or DNS Filter security profiles.
Step 01: Free Verification CLI (Safe Read-Only)
Execute these commands to confirm whether urlfilter workers are locked in 100% CPU loops and identify the compiled feed resources:
Diagnostic Commands
# 1. Check if urlfilter is pinning CPU cores to near 100%
diagnose sys top 2 5 | grep urlfilter
# 2. Query urlfilter application status and active worker threads
diagnose test application urlfilter 1
# 3. Dump compiled external resource tables and entry counts
diagnose test application urlfilter 3
# 4. Check WAD algorithm worker memory footprint
diagnose test application wad 2500Remediation & Workaround Steps (Teaser Preview)
Follow the complete step-by-step remediation guide in the Ferrite interactive platform:
Frequently Asked Questions
Unescaped or duplicate wildcards in external threat feeds trigger non-deterministic exponential backtracking inside the libpcre engine, locking the evaluating thread in an infinite loop.
Yes. Disabling the external resource under config system external-resource and recycling the stuck worker PID with diagnose sys kill 15 <pid> immediately restores normal CPU levels.
FortiOS 7.2.8+ enforces strict syntax validation during feed download and imposes a hard recursion limit (match limit 10,000) on the PCRE evaluator, discarding malformed tokens before compilation.